24 npm Packages Used as Infrastructure for Fake Cloudflare CAPTCHA Phishing Campaign
A campaign has been discovered leveraging 24 npm packages to host fake Cloudflare CAPTCHA pages, redirecting users to phishing sites.
Cybersecurity researchers have uncovered a novel phishing campaign that utilizes a collection of 24 npm packages to serve as free, disguised infrastructure for malicious redirects. The threat actor's objective is not to infect developers who install these packages, but rather to exploit the npm registry and its mirrors as a seemingly legitimate platform for hosting phishing pages.
The campaign specifically targets services like unpkg, a popular CDN for npm packages. By embedding a single HTML file within each package, the threat actor can leverage unpkg mirrors to render these files as live, functional web pages. These pages impersonate Cloudflare CAPTCHA verification screens, a tactic designed to trick unsuspecting users into believing they are interacting with a legitimate security check.
Once a user encounters one of these fake CAPTCHA pages, typically through a link hosted on the npm mirror, they are prompted to complete a verification. This interaction, however, is a ruse. Instead of performing a security check, the user is redirected to an external website controlled by the attacker. Initial analysis revealed that these redirects pointed to typosquatting domains mimicking Microsoft login pages.
However, the threat actor demonstrated adaptability when their initial domains were flagged by Google Chrome's Safe Browsing. They quickly pivoted to using KeyVal, a public key-value store service, as a dead drop resolver (DDR). This method allows the attacker to store and retrieve the actual phishing site URL, effectively obscuring the final destination from immediate detection.
While the current payload redirects users to the legitimate ChatGPT website, researchers caution that this infrastructure is highly flexible. The threat actor can easily reconfigure the KeyVal store to point to any phishing domain, including those designed for credential harvesting or malware distribution, such as the ClickFix-style pages mentioned by researchers.
This exploitation of npm mirrors is not unprecedented. In October 2025, a similar campaign dubbed Beamglea was identified, where 175 npm packages were used to host redirect scripts pointing to credential harvesting sites via unpkg.com. This highlights a recurring tactic where threat actors abuse trusted infrastructure to host malicious payloads and evade detection.
Researchers emphasize that this campaign underscores a broader trend of infrastructure abuse by malicious actors. Beyond traditional malware deployment, threat actors are increasingly using legitimate services like npm for storage and persistence, as packages can remain on mirrors indefinitely even after removal from official repositories. This strategy complicates detection and attribution efforts, as the malicious content is hosted on seemingly reputable domains.
The implications of this campaign extend beyond simple phishing. By using trusted infrastructure, attackers can potentially bypass security controls that might otherwise block access to known malicious IPs or domains. The adaptability of the threat actor, quickly switching from flagged domains to a dead drop resolver, further illustrates the evolving tactics used in cybercrime.